1

Hi using w32tm or some other service (NTP W32Time) is there away to increase the accuracy of windows time to sync at-least every 1sec? Whats setup; windows 2003 AD environment with a few servers and AD clients. At the moment when users log on to the domain they will sync their time with the AD. However most of the users logged on to the servers stay logged in and will lose sync after some time. And all clients and servers have static IP’s. So I’m looking to setup NTP to update more frequently the time on all servers and clients as the application running on the system require very accurate time sync

Any Idea's?

3 Answers 3

4

I'll agree with sysadmin1138 on the first 2 sentences in his answer:

That's not how NTP works, presuming a full NTP client. NTP works by disciplining the local clock so it can't fall out of sync, rather than hard-setting it back to true.

The rest, while true, is quite unnecessary.

All domain controllers are NTP servers by default. The DC which holds the "PDC Emulator" FSMO role should be configured to sync with an Internet NTP server, preferably a stratum 2 server. All other DCs will automagically sync themselves with that DC.

All domain members will automagically sync with their closest DC.

With the exception of the configuration of the PDC Emulator DC, all of this happens with no manual configuration required. There's really no need to mess with it under normal circumstances.

If you have non-Windows machines in your environment, you can simply configure them to use your AD domain name as an NTP server (assuming they are using the same DNS servers as your domain member machines), since the DNS A record for the AD domain name always resolves to all DC IP addresses.

4
  • "All domain members will automagically sync with their closest DC." - in my experience they don't always do this - you have to do a 'net time /domain /set' to get machines to sync their clocks. Not sure why, but it seems to happen quit a bit on desktops and servers alike.
    – Ian Murphy
    Sep 6, 2013 at 15:38
  • There may be something flaky on your network. I've worked with a fair amount of AD setups and never had that sort of issue. Sep 9, 2013 at 7:36
  • I've seen this from the perspective of doing remote management of clients networks. I've seen the same thing on disparate networks with nothing in common, so its not an issue with one network config. Most notable has been when it has occured to domain joined servers (not DC's) which have not been rebooted in quite some time (3+ months) and we find clock drift. I know this shouldn't occur, but I have seen it and often. Its always on servers which have an incorrect ntp setup.
    – Ian Murphy
    Sep 10, 2013 at 10:18
  • That's still pretty odd. The default configuration is to find NTP hosts via AD and in my experience its been bulletproof. Perhaps people have been tampering with the defaults unneccesarily. I've seen some of that, and without fail returning to the defaults fixes any weirdness. Sep 10, 2013 at 11:10
0

That's not how NTP works, presuming a full NTP client. NTP works by disciplining the local clock so it can't fall out of sync, rather than hard-setting it back to true. Since you're in an Active Directory environment, you have some group policy options available to you to configure NTP an all domained machines. The key policies are found in Administrative Templates -> System -> Windows Time Service. These settings enable or disable NTP-client (or server!) services, and allow you to tune NTP internals.

Under Time Providers -> "Configure Windows NTP Client" you can configure the NTP servers the clients will use.

Under 'Global Configuration Options' you can set the parameters for the service. The poll intervals are powers of two seconds, not actual seconds. So a value of 4 will be 16 seconds, and 12 will be over an hour. NTP clients start at the MinPoll interval, and gradually work up to the MaxPoll interval as uptime increases and time reliability (i.e. the local-clock needs less adjustment) improves.

Setting your Domain Controller policy so your DC's have NTP Server enabled, and using your Domain Computers policy to enable the NTP client and point them all at the DC's will create a NTP hierarchy without having to visit every station.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .